5 ms·

MobileCoin is backed by XLM/Stellar, which is not decentralized, and so I feel I should note here that I signed up during Stripe's giveaway of Stellar Lumens ye

MobileCoin is backed by XLM/Stellar, which is not decentralized, and so I feel I should note here that I signed up during Stripe's giveaway of Stellar Lumens years ago - and I did indeed get my wallet credited. https://stripe.com/blog/stellar https://stripe.com/blog/stellar I was given 6000 XLM and I left it in their official wallet for years. On May 12th, 2017 I wrote them an email asking why my wallet, now converted to some newer official wallet, was empty. I did not receive a reply for 2 months, at which point I followed up and received a reply within a day, which was: "I have investigated your account and it looks like an account merge operation occurred some time ago merging your lumens with another account. If you did not commit this action, it could be possible that someone was able to obtain your account information. You can see the merge operation here: https://horizon.stellar.org/accounts/GD2CPSK2E3TUNC2N5NGGQJQYOHJNFW42YZ55MPQKPQ5BGI2ZPD72G3H3/operations https://horizon.stellar.org/accounts/GD2CPSK2E3TUNC2N5NGGQJQ... Unfortunately there is nothing we can do to retrieve your lumens at this point. Apologies we cannot be of further help." I have pretty damn good security of my various accounts using hardware 2FA and such, and I also transact in cryptocurrency and have wallets with far more fiat value in them than 6000 XLM had at the time ($120-150 USD if I recall), with absolutely no issue - and I hadn't even logged into their official wallet. The developers were 100% quick to blame this merge on me. I replied with a flat: "I highly doubt you are correct that it is my fault" email and it went back and forth with them asking the basic "well, did you get spearphished somehow" as if anyone even knew what XLM were or cared. The process dragged on for a month while I bothered people in their Slack channel since email communication dropped out and they finally came back with: "Our team has investigated and checked for multiple different types of issues and have not found anything on our end that shows any type of security compromise in our system. Unfortunately this means at this moment I do not have a concrete answer to how your account was compromised. I’ll follow up again to check if there is anything on your end they would recommend you do." I investigated on my own and found a number of accounts who were "hacked" and sent XLM coins to the wallet that I had merged with, all that just kind of sat there, indicating a software error on their end of a bunch of accounts that were randomly emptied. I provided all documentation to their team and spent a solid 15-20 hours doing so. Their response to all of this bug bounty-type work? "They have identified one potential issue in the past that affected only a small number of accounts, possibly yours. This bug was fixed once discovered back in 2014, but users who may have been vulnerable to the bug were still impacted during the upgrade process to the new network even after it was resolved. Although we think this was the cause of what happened, we cannot be 100% sure if this was what impacted your account considering you had a strong password and none of your other accounts were compromised." And: "Although we cannot recover you original lumens from your account, we’d like to award you 3000 lumens as part of our Bug Bounty Program because you have helped us in identifying a possible issue that happened in the past." So they basically gave me half the XLM back instead of the full amount despite it being entirely their fault and them having no idea how to investigate while I exposed a serious flaw in how XLM were assigned and paid to their wallets, all while blaming me the entire time and with atrociously slow customer response times. Forgive me if I'm not the biggest XLM/Stellar Lumens fan; their team is both terrible at support and suggests that at least their frontline investigators are technically incompetent since they couldn't figure out the merge situation before I did with simple API poking around and enumerating.

bkolobara 9y ago
You are complaining about receiving free money, but not caring about it until the price went up recently. How is this even remotely Stellar's issue?
- icelancer 9y ago
  >>You are complaining about receiving free money Aside from the fact that this is a terrible line of argumentation ("Person A gave you $100 and then Person B later stole it out of your house, what's your problem with that?"), that is not the point of my comment at all. I suggest you read a bit more specifically in regards to service, transactional security, and the fact that the coin is federated and not decentralized.
  - bkolobara 9y ago
    You didn't even realise for a long time that you lost access to it. It's like me remembering that I had some BTC, but can't access them anymore and blaming Bitcoin developers for not getting rich. Stellar not being decentralised, even 90% of nodes are not run by the SDF, makes it somehow unsecure? If you have some specific complaint about the security point it out, instead you are just ranting on an anecdote.
    - icelancer 9y ago
      >>If you have some specific complaint about the security point it out I did, in the post. I'm not sure why you are making a big deal about the money I lost. I am certainly not. It is about the mechanism by which it happened and how they didn't take it very seriously. EDIT: I am also not even sure to this day what the value of XLM is, and don't particularly care. I gather from your post that it has gone up. Congratulations. I think XLM's architecture and use case makes a lot of sense. I also think their developers and support team are quite poor. That is the intent of my post.
    - monkeywork 9y ago
      care to disclose what connection you have with Stellar -- your blind defense and smoke screening makes it seem like you have an interest in making sure bad press (legit or not) doesn't come to light.

bkolobara 9y ago

You are complaining about receiving free money, but not caring about it until the price went up recently. How is this even remotely Stellar's issue?

icelancer 9y ago
>>You are complaining about receiving free money Aside from the fact that this is a terrible line of argumentation ("Person A gave you $100 and then Person B later stole it out of your house, what's your problem with that?"), that is not the point of my comment at all. I suggest you read a bit more specifically in regards to service, transactional security, and the fact that the coin is federated and not decentralized.
- bkolobara 9y ago
  You didn't even realise for a long time that you lost access to it. It's like me remembering that I had some BTC, but can't access them anymore and blaming Bitcoin developers for not getting rich. Stellar not being decentralised, even 90% of nodes are not run by the SDF, makes it somehow unsecure? If you have some specific complaint about the security point it out, instead you are just ranting on an anecdote.
  - icelancer 9y ago
    >>If you have some specific complaint about the security point it out I did, in the post. I'm not sure why you are making a big deal about the money I lost. I am certainly not. It is about the mechanism by which it happened and how they didn't take it very seriously. EDIT: I am also not even sure to this day what the value of XLM is, and don't particularly care. I gather from your post that it has gone up. Congratulations. I think XLM's architecture and use case makes a lot of sense. I also think their developers and support team are quite poor. That is the intent of my post.
  - monkeywork 9y ago
    care to disclose what connection you have with Stellar -- your blind defense and smoke screening makes it seem like you have an interest in making sure bad press (legit or not) doesn't come to light.